Security Report: consultadadosbrasil.api.br - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/3249be16-639a-4e9f-b8f0-964bd2b6c740 Domain and IP registration (RDAP)/api/v1/rdap/3249be16-639a-4e9f-b8f0-964bd2b6c740How often this domain was scanned/api/v1/domain/stats/consultadadosbrasil.api.br Scan history for this domain/api/v1/domain/history/consultadadosbrasil.api.br?limit=15

This website contacted 11 IPs in 3 countries across 10 domains to perform 42 HTTP transactions. The main domain is api.br.

Submitted URL: https://consultadadosbrasil.api.br

AI Security Verdict

Confirmed Scam

Confidence: 93%

Risk Score

Page is compromised: analyst-vetted ErrTraffic/Exvicy WordPress loader, CRITICAL YARA and EtherHiding IDS malware alerts, and blockchain-RPC exfiltration. Own content is benign, but the site is serving malicious code.

Risk Factors (6)

Known malicious injected kit (ErrTraffic/Exvicy) present on the page

CRITICAL YARA malware signature on page HTML

CRITICAL IDS malware alert: EtherHiding exfiltration

Blockchain RPC / smart-contract based exfiltration (EtherHiding pattern)

External malicious resource loaded from lovezramexar.info (exploit-kit 'clearfake-1', multi-feed)

Primary domain itself flagged as a malware loader

Domain age information unavailable

Details

Page Title

Consulta Dados Brasil – Consulta simplificada de CPF, CNPJ e dados públicos brasileiros.

Scan Type

public

Domain Name Analysis

The domain 'consultadadosbrasil.api.br' uses the Brazilian country-code top-level domain (.api.br) with no subdomain. The second-level label 'consultadadosbrasil' is 19 characters long with seven vowels and twelve consonants. Tokenizing the label suggests four words: consult, a, dados, brasil. Median word length comes out to 5.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.68s

Total Load Time

1.1 MB

Total Size

Language Analysis

Primary Language

🇵🇹Portuguese

Code: pt

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:pt-BR

Text Length:1,138 chars

Detector Agreement:100%

Website Classification

Primary Category

government public service71% confidence

Type: spa

Method: ml+structural

All Detected Categories

government public service

71%

finance banking

67%

corporate business

63%

healthcare medical

45%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
12	51.222.80.94	Canada	AS16276OVH SAS
3	142.251.14.95Google · CDN	United States	AS15169Google LLC
3	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
3	142.251.14.94Google · CDN	United States	AS15169Google LLC
3	44.206.88.86Aws · CLOUD	Ashburn, Virginia, United States	AS14618Amazon.com, Inc.
3	157.240.0.35Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
3	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
3	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
42	11	-	-